apollo_starknet_os_program,starknet_os: add the Cairo0 proof-fact fold tree

[einat-starkware]

Fourth PR of the privacy proof-fact fold stack. Adds the fold tree above the leaf digest in Cairo0: fold_block_proof_facts folds a block's ProofFactsReference array into the block's root fold entry (leaf entries, pairwise folding with a carried trailing entry, single-transaction self-fold), and compute_fold_digest computes the digest the Cairo circuit verifier outputs for that entry. Still not reachable from the OS program — the OS output wiring lands in #15064.

ProofFactsReference carries each transaction's leaf_circuit_index alongside its proof facts, and build_leaf_entries stamps each leaf with the indexed hash from the allowed-circuits table (range-checked in #15092's getter). The production registry keys leaf circuits by trace size, so the index becomes real per-transaction OS input on the production swap; until then everything records index 0.

Tested for bit-exact agreement with the Rust mirror across tree shapes exercising the pairing and carry rules (N = 1, 2, 3, 4, 5, 7).

Stack: leaf digest (#15090) ← rust tree fold (#15091) ← cairo leaf digest (#15092) ← this PR ← OS output wiring (#15064) ← registry pin (#15086) ← verifier task (#15088) ← combined test (#15095).

🤖 Generated with Claude Code

https://claude.ai/code/session_01XmPJM3Wph4QLmFmhcxVsh4

[cursor]

PR Summary

Medium Risk
Changes cryptographic folding logic that must stay bit-exact with Rust, but the new Cairo entry points are isolated from production OS execution until output wiring lands.

Overview
Adds the Cairo0 proof-fact fold tree above the existing leaf digest so a block’s per-transaction proof facts can be folded into the root entry the privacy verifier expects. New Cairo helpers fold_block_proof_facts (pairwise folds over a block’s proof-fact references, including a carried trailing entry and the single-transaction self-fold case) and compute_fold_digest (Blake2s digest of a fold entry) mirror the Rust fold stack; build_leaf_entries builds leaf fold entries using each tx’s leaf_circuit_index and the allowed leaf-verifier circuit hash table.

The fold program is compiled and exercised via PROOF_FACT_FOLD_BYTES cross-tests against the Rust mirror for tree sizes N = 1, 2, 3, 4, 5, 7. This stack step is not wired into the OS program output yet (follow-up #15064).

^{Reviewed by Cursor Bugbot for commit 0ce5d55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[einat-starkware]

Closing: the stack was restructured around a first milestone — verifying a single transaction's proof against the OS output — and proof-fact folding over several transactions is deferred to a later phase. The Cairo0 fold tree from this PR (pairwise layers, carry rule, multi-leaf fold_block_proof_facts) will return in that phase; the single-transaction self-fold it needs today moved into #15092. This PR's branch now aliases #15092's head so the stack chain stays intact.

---

Generated by Claude Code